CVE-2026-84316
HighCVSS 8.8Summary
Nginx UI prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.
Risk Assessment
An attacker can bypass configuration validation and inject dangerous directives, potentially leading to code execution in the Nginx worker context and server security compromise.
Recommendation
It is recommended to upgrade Nginx UI to version 2.4.1 or later and strengthen configuration validation to check all directives on each line.
Other vulnerabilities in Nginx UI
See all- CVE-2026-107809High
In Nginx UI from 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally require a CSRF token or perform Origin or Referer validation, a remote attacker can induce a logged-in administrator's browser to submit authenticated cross-site state-changing requests, including POST /api/configs.
- CVE-2026-107804Medium
Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attributed to loopback and pass the IP allowlist loopback exception, although valid credentials are still required. Failed logins from different external clients are also attributed to the same loopback address, allowing an unauthenticated attacker to trigger a shared temporary login ban for password or OTP authentication without invalidating existing sessions. This issue is fixed in version 2.6.0.
- CVE-2026-44015High
Nginx UI is a web user interface for the Nginx web server. In versions 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF) by creating a cluster node pointing to an arbitrary internal URL.
- CVE-2026-42222High
In version 2.3.5 of the Nginx user interface (nginx-ui), there is an unauthenticated bootstrap takeover vulnerability during the initial installation exposed by POST /api/install.
- CVE-2026-42221High
Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim the initial administrator account on a fresh nginx-ui instance during the first-run setup window.
- CVE-2026-107806Critical
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability.
- CVE-2026-42238Critical
Nginx UI, a web user interface for the Nginx web server, prior to version 2.3.8, exposed a backup restore endpoint (POST /api/restore) that was completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker could upload a crafted backup archive that overwrote the application's configuration file and SQLite database.
- CVE-2026-84312High
Nginx UI prior to 2.4.1 uses a constant OAuth state value and does not verify state in CasdoorCallback, allowing an unauthenticated attacker to hijack a user's session.
- CVE-2026-84360High
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the HTTP configuration mutation routes require RequireSecureSession, but /mcp and /mcp_message require only ordinary authentication before exposing nginx_config_add and nginx_config_modify. An OTP-enabled user with a normal JWT but no valid X-Secure-Session-ID can therefore create or modify Nginx configuration and trigger reload behavior through MCP, bypassing the intended step-up control. This issue is fixed in version 2.4.1.
- CVE-2026-84321Medium
Nginx UI prior to version 2.4.1 contains a vulnerability where generated short tokens lack an associated long Token value, and DeleteUserTokens invalidates cache entries only when the long Token field is nonempty. A revoked short token can remain in the cache and re-authenticate if the account is re-enabled before the entry expires, restoring access to HTTP or WebSocket routes accepting short-token authentication.
Original NVD description (English source)
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS